aws / aws/aws-cli

Inconsistent implementations of a hashing function for SSO cached secrets between different SDKs

Open
#9,035 0 comments 1 reaction 0 assignees View on GitHub
cross-sdk feature-request p2 sso
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Introduction

After successfull SSO auth, a cache is saved to files with with the following path:
`~/.aws/sso/cache/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.json`, where "xxxxx..." is a hash derived from some fields of a profile.

# Describe the problem

It appears that there's no standard way of calculating this hash. Different AWS SDKs have different implementations, to list a few that I've checked (links point directly to implementations):

| SDK | hash function |
| --- | --- |
| [botocore](https://github.com/boto/botocore/blob/1eaa8aed894ce6d3cbfd038a358f2dfe55444926/botocore/credentials.py#L2096) | sha1 a json containing [`sso_start_url` or session name], roleName, accountId |
| [aws-sdk-cpp](https://github.com/aws/aws-sdk-cpp/blob/c005754b0c854373b7be208542e204c938da3c0c/src/aws-cpp-sdk-core/source/auth/SSOCredentialsProvider.cpp#L60) | sha1 a `sso_start_url` |
| [aws-sdk-go (v1)](https://github.com/aws/aws-sdk-go/blob/5eaabf6fe3cc4d62e2e1728d44cffc43092371c8/aws/credentials/ssocreds/provider.go#L150) | sha1 of `sso_start_url` |
| [aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2/blob/7177df0f8b7b264c5d5f0939ca23e5a0d43636cf/credentials/ssocreds/sso_credentials_provider.go#L98) | sha1 of `sso_start_url` |
| [aws-sdk-java-v2](https://github.com/aws/aws-sdk-java-v2/blob/81d0e84597487a6a55a392e343a6f45b36784172/services/sso/src/main/java/software/amazon/awssdk/services/sso/internal/SsoTokenFileUtils.java#L51) | sha1 of `sso_start_url` |
| [aws-sdk-net](https://github.com/aws/aws-sdk-net/blob/d85a9c0bfb7dca401583436b0072a5b6a4bcae81/sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SSOTokenFileCache.cs#L310) | sha1 of [`sso_start_url` OR session name] |

See the example below for why exactly this is a problem.

# Proposed solution

Enforce a single, standard way of calculating this hash it across all SDKs.

# Example instance of this problem

My team uses aws cli (botocore SDK) to authenticate to AWS via SSO, and right now we're trying to configure Nix binary cache which is stored on s3. We're unable to authenticate Nix tool, because Nix (which uses aws-sdk-cpp) can't read secrets created by `aws sso login` due to a mismatch of secret filenames.

Contributor guide

Open the contributing guide

Research direction

Start by comparing the linked implementations in botocore/credentials.py, SSOCredentialsProvider.cpp, the Go ssocreds provider files, SsoTokenFileUtils.java, and SSOTokenFileCache.cs. Determine the compatibility requirements from the cache filename example and verify that the proposed standard produces matching filenames across SDKs; done means aws sso login credentials can be read by the listed SDKs.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, cpp, csharp, go, java, python
Domain
authentication, cli, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.